namespace ZB.MOM.WW.Secrets.Abstractions;

/// <summary>Thrown when the master key (KEK) required to wrap or unwrap a DEK is unavailable.</summary>
public sealed class MasterKeyUnavailableException(string message) : InvalidOperationException(message);

/// <summary>Thrown when a secret's ciphertext cannot be decrypted or its authentication tag fails to verify.</summary>
public sealed class SecretDecryptionException : InvalidOperationException
{
    /// <summary>Creates the exception with a message describing the decryption failure.</summary>
    /// <param name="message">The failure description.</param>
    public SecretDecryptionException(string message) : base(message) { }

    /// <summary>Creates the exception, preserving the underlying cryptographic fault.</summary>
    /// <param name="message">The failure description.</param>
    /// <param name="innerException">The original cryptographic exception that caused the failure.</param>
    public SecretDecryptionException(string message, Exception innerException) : base(message, innerException) { }
}

/// <summary>Thrown when a requested secret does not exist (or is tombstoned) in the store.</summary>
public sealed class SecretNotFoundException(string message) : InvalidOperationException(message);

/// <summary>Thrown when the secret store cannot be migrated to the supported schema.</summary>
public sealed class SecretStoreMigrationException(string message) : InvalidOperationException(message);
